Software systems are growing in complexity and are playing an important role in various industries. As a result, the users of software systems are demanding higher quality software systems, which, for example, have zero service downtime. Furthermore, the software industry is also placing greater demands on software developers by continually raising software quality standards. For example, in the telecommunications industry, network outages or even brief interruptions of service can have significant effect on users. A user, such as a bank, may lose millions of dollars during a brief service outage. On a more global scale, failure of densely interconnected networks essential to government operations may pose a national security risk.
To minimize the risk associated with software systems, and thus to increase the quality of the software systems, existing quality assurance tools generate and track, at various phases of the software development life cycle, risk factor data, for example, metrics associated with the modifications made to software systems during the development life cycle. Risk factor data typically includes code complexity metrics and development process metrics, which aid software developers in assessing or predicting risk associated with software systems.
Software developers have integrated these tools into various phases of the software development life cycle. For example, software developers use the code complexity metrics to identify the components that have greater risk to intensify the line-by-line inspection of the identified components. Similarly, development process metrics aid software testers to identify high risk components and to develop comprehensive plans for testing these components.
The existing quality assurance tools, however, narrowly focus on only one type of risk factor such as code complexities and development process metrics. As a result, the resulting risk assessment is not useful in many circumstances because accurate risk assessments generally cannot be based on a single risk factor. Although various other types of risk factor data can be measured separately or collectively by the existing tools, these factors generally are not used in making risk assessments, in part, because the interaction of these factors among each other and the effect of these factors on the risk assessments are not known.
Thus, it is desirable to have a method and system for assessing risks of software systems without the above-mentioned disadvantages.